N°6282 Fix XSS vulnerability in soap

Combodo · Dec 16, 2024 · 9ae372f · 9ae372f
1 parent 32ef639
commit 9ae372f
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/webservices/soapserver.php b/webservices/soapserver.php
@@ -26,9 +26,10 @@
 
 // this file is generated dynamically with location = here
 $sWsdlUri = utils::GetAbsoluteUrlAppRoot().'webservices/itop.wsdl.php';
-if (isset($_REQUEST['service_category']) && (!empty($_REQUEST['service_category'])))
+$sServiceCategory = utils::ReadParam($_REQUEST['service_category']);
+if (!empty($sServiceCategory))
 {
-	$sWsdlUri .= "?service_category=".$_REQUEST['service_category'];
+	$sWsdlUri .= "?service_category=".$sServiceCategory;
 }
 
 
@@ -43,9 +44,9 @@
 	)
 );
 // $oSoapServer->setPersistence(SOAP_PERSISTENCE_SESSION);
-if (isset($_REQUEST['service_category']) && (!empty($_REQUEST['service_category'])))
+if (!empty($sServiceCategory))
 {
-	$sServiceClass = $_REQUEST['service_category'];
+	$sServiceClass = $sServiceCategory;
 	if (!class_exists($sServiceClass))
 	{
 		// not a valid class name (not a PHP class at all)